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Question: 1 


You have a server named Server1 that runs Windows Server 2012 R2. Server1 has the Hyper-V server 
role installed. 

An iSCSI SAN is available on the network. 

Server! hosts four virtual machines named VM1, VM2, VM3, and VM4. 

You create a LUN on the SAN to host the virtual hard drive files for the virtual machines. 

You need to create a 3-TB virtual hard disk for VM1 on the LUN. The solution must prevent VM1 from 
being paused if the LUN runs out of disk space. 

Which type of virtual hard disk should you create on the LUN? 


A. Dynamically expanding VHDX 
B. Fixed-size VHDX 

C. Fixed-size VHD 

D. Dynamically expanding VHD 


Answer: B 


Explanation: 

The virtual disk needs to be a VHDxX file since it is going to be over 2TB in size and it must be fixed- 
size so that the space is already taken on the server (that way the server does not run out of space as 
the volume grows) even if the actual virtual disk does not yet hold that amount of data. 


Question: 2 


Your network contains an Active Directory domain named adatum.com. The domain contains a 
member server named Host1. Host1 runs Windows Server 2012 R2 and has the Hyper-V server role 
installed. 

Host1 hosts two virtual machines named VM5 and VM6. Both virtual machines connect to a virtual 
switch named Virtual1. 

On VMS, you install a network monitoring application named Monitor. 

You need to capture all of the inbound and outbound traffic to VM6 by using Monitor1. 

Which two commands should you run from Windows PowerShell? (Each correct answer presents 
part of the solution. Choose two.) 


A. Get-VM “VM6” | Set-VMNetworkAdapter-lovWeight 1 

B. Get-VM “VM5" I Set-VMNetworkAdapter -lovWeight 0 

C. Get-VM “VM5” | Set-VMNetworkAdapter -PortMirroring Source 

D. Get-VM “VM6” | Set-VMNetworkAdapter -AllowTeaming On 

E. Get-VM “VM6” | Set-VMNetworkAdapter -PortMirroring Destination 
F. Get-VM “VM5” | Set-VMNetworkAdapter -AllowTeaming On 
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Answer: C, E 


Explanation: 

-PortMirroring specifies the port mirroring mode for the network adapter. This can be set to None, 
Source, and Destination. 

If set to Source, a copy of every network packet it sends or receives is forwarded to a virtual network 
adapter configured to receive the packets. 

If set to Destination, it receives copied packets from the source virtual network adapter. 

In this scenario, VM5 is the destination which must receive a copy of the network packets from VM6, 
which s the source. 


Reference: http://technet.microsoft.com/en-us/library/hh848457.aspx 


Question: 3 


You have a Hyper-V host named Server1 that runs Windows Server 2012 R2. Server1 has the virtual 
switches listed in the following table. 


Virtual switch name Virtual switch) Physical network 


type __ adapter name 
vSwitchi [External NIC1 
[External NIC2 


You create a virtual machine named VM1.VM1 has two network adapters. One network adapter 
connects to vSwitch1. The other network adapter connects to vSwitch2.You configure NIC teaming on 
VM1. 

You need to ensure that if a physical NIC fails on Server1, VM1 remains connected to the network. 
What should you do on Server1? 


A. Run the Set-VmNetworkAdaptercmdlet. 

B. Add a new network adapter to VM1. 

C. Create a new virtual switch on Server 1. 

D. Modify the properties of vSwitch1 and vSwitch2. 


Answer: A 


Question: 4 


Your network contains two Hyper-V hosts that run Windows Server 2012 R2. The Hyper-V hosts 
contain several virtual machines that run Windows Server 2012 R2. 

You install the Network Load Balancing feature on the virtual machines. 

You need to configure the virtual machines to support Network Load Balancing (NLB). 

Which virtual machine settings should you configure? 


A. DHCP guard 
B. Port mirroring 
C. Router guard 
D. MAC address 
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Answer: D 


Explanation: 


http://social.technet.microsoft.com/Forums/windowsserver/en-US/5b3a0a9d-26a2-49ba-bbbe- 


29d11fcbb7ce/nlb-on-hyperv?forum=winserverhyperv 


For NLB to be configured you need to enable MAC address spoofing. 


Question: 5 


You have a server named Server1 that runs Windows Server 2012 R2. Server1 has the Hyper-V server 
role installed. Server1 is connected to two Fibre Channel SANs and is configured as shown in the 
following table. 


Host bus adapter (HBA) name (Fibre Channel SAN name 


HBA1 SAN1 
HBA2 SAN2 
HBA3 SAN1 | 
HBA4 SAN2 


You have a virtual machine named VM1. 
You need to configure VM1 to connect to SAN1. 
What should you do first? 


A. Add one HBA 

B. Create a Virtual Fibre Channel SAN. 
C. Create a Hyper-V virtual switch. 

D. Configure network adapter teaming. 


Answer: B 


Explanation: 

You need your virtualized workloads to connect easily and reliably to your existing storage arrays. 
Windows Server 2012 provides Fibre Channel ports within the guest operating system, which allows 
you to connect to Fibre Channel directly from within virtual machines. This feature protects your 
investments in Fibre Channel, enables you to virtualize workloads that use direct access to Fibre 
Channel storage, allows you to cluster guest operating systems over Fibre Channel, and provides an 
important new storage option for servers hosted in your virtualization infrastructure. 

With this Hyper-V virtual Fibre Channel feature, you can connect to Fibre Channel storage from 
within a virtual machine. This allows you to use your existing Fibre Channel investments to support 
virtualized workloads. 

Support for Fibre Channel in Hyper-V guests also includes support for many related features, such as 
virtual SANs, live migration, and MPIO. 
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&_ Virtual Fibre Channel SANs “| Create Virtual Fibre Channe! Storage Area Network 
2 Global Fibre Channel Settings Click Create to add a virtual Fibre Channel storage area network (SAN), 
Mi vorid Wide Names veut Fave aama SAN n] 


A vietual Fibre Channel SAN groups physical HBA ports together. You can add a virtual 


Fibre Channel adapter to a virtual machine and connect it to a virtual SAN. 


Question: 6 


Your network contains an Active Directory domain named contoso.com. The domain contains a 
server named Server1. Server1 runs Windows Server 2012 R2 and has the Hyper-V server role 
installed. 

On Server1, you create and start a virtual machine named VM1. VM1 is configured as shown in the 
following table. 


Configuration 
Minimum RAM 2048 MB 

Maximum RAM 4096 MB 

Disk type Fixed size 

Disk size 100 GB 


You need to recommend a solution to minimize the amount of disk space used for the checkpoint of 
VM1. 
What should you do before you create the checkpoint? 


A. Run the Resize-VHD cmdlet. 

B. Convert Disk1.vhd to a dynamically expanding disk. 
C. Shut down VM 1. 

D. Run the Convert-VHD cmdlet. 


Answer: C 


Explanation: 

Changing between a fixed and dynamic disk type does not alter the size of a SNAPSHOT much at all. 
However, since a snapshot is a record of a VMs state at the exact time that the snapshot was taken, 
shutting down the VM before taking the snapshot prevents the snapshot from having to contain all of 
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the data in RAM (as there is no data in memory when a machine is powered down). 

The question states that the solution should minimize the amount of disk space used for the 
checkpoint of VM1. If the checkpoint is taken while VM1 is running, there will be two attritional files 
present at the checkpoint location; a VSV with VM1 saved state files and a .BIN file which contains 
VM1’s memory contents. If, however, VM1 is shut down first, these files will not be created, thus 
saving disk space. 

In order to convert Disk1.vhd to a dynamically expanding disk, VM1 still have to be shut down. 


Question: 7 


HOTSPOT 

You have a Hyper-V host named Hyperv1 that runs Windows Server 2012 R2. Hyperv1 hosts a virtual 
machine named Server1. Server1 uses a disk named Server1.vhdx that is stored locally on Hyperv1. 
You stop Serverl, and then you move Server1.vhdx to an iSCSI target that is located on another 
server. 

You need to configure Server1 to meet the following requirements: 

Ensure that Server1 can start by using Server1.vhdx. 

Prevent Server1.vhdx from consuming more than 500 IOPS on the iSCSI target. 

Which two objects should you configure? To answer, select the appropriate two objects in the answer 
area. 
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C:\ProgramData \Micrasoft\Windo... 


Answer: 
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Question: 8 


You have a print server named Server1 that runs Windows Server 2012 R2. 

You discover that when there are many pending print jobs, the system drive occasionally runs out of 
free space. 

You add a new hard disk to Server1.You create a new NTFS volume. 

You need to prevent the print jobs from consuming disk space on the system volume. 

What should you modify? 


A. The properties on the new volume 

B. The properties of the Print Spooler service 
C. The Print Server Properties 

D. The properties of each shared printer 


Answer: C 


Explanation: 

Windows spools print jobs by default to the following directory as they are processed: 
%SystemRoot%\SYSTEM32\SPOOL\PRINTERS. 

It is possible for the administrator of a Windows print server to manually instruct Windows the 
location for placing the spool files, if for example there is a concern for disk space. 
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Question: 9 


HOTSPOT 
A printer named Printer1 is configured as shown in the exhibit. (Click the Exhibit button.) 


Administrator; Windows PowerShell 
:\> Get-Printer Printeri Format-List 


Printeri 
omputerName - 
ype : Local 
Shar eName : Printeri 
PortName > LPT1:,LPT2: 
iver Nan : Brother Color Leg Typel Class Driver 


SeparatorPageFile : 
PrintProcessor : winprint 
Datatype : RAW 
Shared : True 
Published : False 
Permiss1onSDDL r 
Renderingħode 

KeepPrintedJobs 

Priority 

DefaultJobPriority 

StartTime 

Unt ITime 

PrinterStatus 

JobCount 

DisableBranchOfficeLogging 
BranchOffi ceOfflineLogSi zeMB 


To answer, complete each statement according to the information presented in the exhibit. Each 
correct selection is worth one point. 


Answer Area 


If a user prints a document toj | 


Printeri, the document will... 


Users can submit print jobs to 
Printer] ... 
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Answer Area 


If a user prints a document toj -] 


Printeri, the document will... 


remain in the print queue, 
print immediately on LPT1. 
print immediately on LPT2. 


Users can submit print jobs to 
Printeri ... 


between 01:00 and 10:00. 
between 10:00 and 17:00. 


Answer: 


Answer Area 


If a user prints a document to 
Printeri, the document will ...; 


print immediately on LPT1. 
print immediately on LPT2. 


Users can submit print jobs to 
Printerl ... 


Explanation: 

* The printer is paused. 

* Jobs can always be permitted (even if the printer is paused, or printer not started). 

Note: 

StartTime 

Date and time that a printer can start to print a job — if the printer is limited to print at specific 
times. This value is expressed as the time elapsed since 12:00 AM GMT (Greenwich Mean Time). 

This is sort of a trick question. As it stands, when the PowerShell script was executed, the printer is in 
"Paused" status, so any submitted job will go to the queue and remain there until the status is 
"Available". As for the ability to submit a job, a user can SUBMIT the job at any time. If it is outside of 
the printer's availability range, it will simply remain in the queue until the printer's start time is 
reached. 


Question: 10 


HOTSPOT 

Your network contains an Active Directory domain named contoso.com. The domain contains a print 
server named Server1 that runs Windows Server 2012 R2. 

You share several printers on Server1. 

You need to ensure that you can view the printer objects associated to Server1 in Active Directory 
Users and Computers. 

Which option should you select? 
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To answer, select the appropriate option in the answer area. 


Answer: 


b i Saved 
4 3 contosa 
p 2) Built 
p OD Com 


p a) Dep 
ra Dorr 
p DI Fore: 
p D Man, 
p T] Users 


Explanation: 

You can view printer objects in Active Directory by clicking Users, Groups, and Computers as 
containers from the View menu in the Active Directory Users and Computers snap-in. By default, 
printer objects are created under the machine object in which they are shared. After you turn on the 
Users, Groups, and Computers as containers option, you can see printers by expanding the printer's 
host computer. 


Reference: http://support.microsoft.com/kb/235925 


Question: 11 


HOTSPOT 
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You have a shared folder named Share1. The folder permissions of Share1 are configured as shown in 
the Folder Permissions exhibit. (Click the Exhibit button.) 


Name D:\Sharel 


Owner: Administrator (SERVER12\Administrator) @ Change 
Permissions Share | Auditing | Effective Access | 


For additional information, double-click a permission entry. To modify a permission entry, select the entry and click Edit (if available), 
Permission entnes: 


Principal Access Condition Inherited from Applies to 

SYSTEM Full control This folder, subfolders and files 
CREATOR OWNER Full control Subfolders and files only 
Group! (CONTOSO\Group1) Read & execute This folder, subfolders and files 
Everyone Modify Not member of each{(Group! (CONTOSO\Group1)}) This folder, subfolders and files 


EF Change permissions 


Enabie inheritance 


The Share permissions of Share1 are configured as shown in the Share Permissions exhibit. (Click the 
Exhibit button.) 


Name: D:\Sharel 


Owner: Administrator (SERVER12\Administrator) Change 


Permissions | Share Auditing A | Effective Access | 


To modify share permissions, use the Share Wizard from the network location for this share- 
Network location for this share: \\SERVER12\Sharetl 


Permission entries: 


Type Principal Access 
A, Allow Everyone Change 
e, Allow Administrators (SERVER12\ Administrators) Full Control 


Remove 


You have a group named Group1. The members of Group1 are shown in the Group1 exhibit. (Click 
the Exhibit button.) 
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Active Directory Domain Services Folder 


contoso.com/ User Environment /Users 


Select Yes if the statement can be shown to be true based on the available information; otherwise 
select No. Each correct selection is worth one point. 


Yes No 

CONTOSO\Wser1 will be able to delete the files e 

in Sharel, 

CONTOSOWWser? will be able to delete the files C 

in Sharel. 

CONTOSO\Administrator will be able to delete e 

the files in Share1, 

Answer: 
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CONTOSO\U 
in Sharel 


serl will be able to delete the files 


CONTOSO\User2 will be able to delete the files 


in Sharel 


CONTOSO\Administrator will be able to delete 
the files in Sharel 


Explanation: 

NTFS permissions control access to the files and folders stored on disk volumes formatted with the 
NTFS file system. Share permissions control access to folders over a network. To access a file over a 
network, a user must have appropriate share permissions (and appropriate NTFS permissions if the 
shared folder is on an NTFS volume).Granting a user Full Control NTFS permission on a folder enables 
that user to take ownership of the folder unless the user is restricted in some other way.User1 was 
not granted Full Control permission. 

The Administrators have Full Control permission. | assume that User2 is an administrator since the 
Group1 exhibit shows only User1 as a member. 

References: http://technet.microsoft.com/en-us/library/cc754178.aspx 

Exam Reference 70-410: Installing and configuring Windows Server 2012 R2, Chapter 2: Configure 
server roles and features, Objective 2.1: Configure file and share access, p.75-80 


Question: 12 


Your network contains an Active Directory domain named adatum.com. The domain contains a 
server named Server1 that runs Windows Server 2012 R2. 

On a server named Core1, you perform a Server Core Installation of Windows Server 2012 R2. You 
join Core1 to the adatum.com domain. 

You need to ensure that you can use Event Viewer on Server1 to view the event logs on Core1. 

What should you do on Core1? 


A. Run the Disable NetFirewallRule cmdlet. 

B. Install Remote Server Administration Tools (RSAT). 

C. Install Windows Management Framework. 

D. Run the Enable-Com + Network Access Firewall Rule. 


Answer: D 


Explanation: 
Information regarding IPsec policy changes, etc. can be found in the Event Viewer. Thus you need to 
enable the NetFirewallRule command. This will allow you to view the event logs. 


Question: 13 


Your network contains two servers named Serverl and Server2 that run Windows Server 2012 R2. 
Server1 and Server2 are part of a workgroup. 
On Server1 and Server2, you create a local user account named Admin1.You add the account to the 
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local Administrators group. On both servers, Admin1 has the same password. 

You log on to Server1 as Admini. You open Computer Management and you.connect to Server2. 
When you attempt to create a scheduled task, view the event logs, and manage the shared folders, 
you receive Access Denied messages. 

You need to ensure that you can administer Server2 remotely from Server1 by using Computer 
Management. 

What should you configure on Server2? 


A. From Server Manager, modify the Remote Management setting. 

B. From Local Users and Groups, modify the membership of the Remote Management Users group. 
C. From Windows Firewall, modify the Windows Management Instrumentation (WMI) firewall rule. 
D. From Registry Editor, configure the LocalAccountTokenFilterPolicy registry value. 


Answer: D 


Explanation: 
The LocalAccountTokenFilterPolicy setting affects how administrator credentials are applied to 
remotely administer the computer. 


Reference: http://support.microsoft.com/kb/942817 


Question: 14 


HOTSPOT 

You have a print server named Server1 that runs Windows Server 2012 R2. 

On Server1, you create and share a printer named Printer1. 

The Advanced settings of Printer1 are shown in the Advanced exhibit. (Click the Exhibit button.) 
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© Always available 
(© Available from 


Brother Color Type4 Class Driver ¥ 


@ Spool print documents so program finishes printing faster 
© Start printing after last page is spooled 
@ Start printing immediately 


J Print directly to the printer 


[C] Hold mismatched documents 
[V] Print spooled documents first 
[| Keep printed documents 


[V] Enable advanced printing features 


— 


soph wh 


The Security settings of Printer1 are shown in the Security exhibit. (Click the Exhibit button.) 
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For special permissions or advanced settings. click Advanced. 


The Members settings of a group named Group1 are shown in the Group1 exhibit. (Click the Exhibit 
button.) 
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[General | Members | Member OF | Managed By | 


_ Active Directory Domain Services Folder 


Select Yes if the statement can be shown to be true based on the available information; otherwise 
select No. Each correct selection is worth one point. 


Userl can print on Printeri on Monday at 
18:00, 


User2 can print on Printerl on Friday at 
14:00. 


Userl can print on Printer1 on Sunday at 
11:00, 


Answer: 
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Userl can print on Printeri on Monday at 
18:00, 


User2 can print on Printer1 on Friday at 
14:00. 


Useri can print on Printerl on Sunday at 
11:00, 


Question: 15 


Your network contains a server named Server1 that runs Windows Server 2012 R2. Server1 has the 
Hyper-V server role installed. 

Server1 hosts four virtual machines named VM1, VM2, VM3, and VM4. 

Server1 is configured as shown in the following table. 


Hardware 
component 


Configuration 


Processor Eight quad-core CPUs that have | 
non-uniform memory access 
(NUMA) 
32 GB of RAM 
Two local 4-TB disks 


Eight network adapters 

VMQ-supported 

PCI-SIG-suppored 

You install Windows Server 2012 R2 on VM2 by using Windows Deployment Services (WDS). 

You need to ensure that the next time VM2 restarts, you can connect to the WDS server by using PXE. 
Which virtual machine setting should you configure for VM2? 


Memory 
Disk 


A. NUMA topology 

B. Resource control 

C. resource metering 

D. virtual Machine Chimney 
E. The VLAN ID 

F. Processor Compatibility 
G. The startup order 

H. Automatic Start Action 

l. Integration Services 

J. Port mirroring 

K. Single-root I/O virtualization 


Answer: G 
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Explanation: 

Configure the BIOS of the computer to enable PXE boot, and set the boot order so that it is booting 
from the network is first. 

References: http://technet.microsoft.com/en-us/library/cc766320(v=ws.10).aspx 

Exam Ref 70-410, Installing and Configuring Windows Server 2012 R2, Chapter 3: Configure Hyper-V, 
Objective 3.1: Create and Configure virtual machine settings, p.144 

Training Guide: Installing and Configuring Windows Server 2012 R2: Chapter 7: Hyper-V 
Virtualization, Lesson 2: Deploying and configuring virtual machines, p.335 


Question: 16 


Your network contains a server named Server1 that runs Windows Server 2012 R2. Server1 has the 
Hyper-V server role installed. 

Server1 hosts four virtual machines named VM1, VM2, VM3, and VM4. 

Server1 is configured as shown in the following table. 


Hardware 
component 


Configuration 


Eight quad-core CPUs that have 
non-uniform memory access 
(NUMA) 


32 GB of RAM 
Two local 4-TB disks 


Processor 


Network Eight network adapters 
VMQ-supported 


PCI-SIG-supported 


You plan to schedule a complete backup of Server1 by using Windows Server Backup. 
You need to ensure that the state of VM1 is saved before the backup starts. 
What should you configure? 


A. NUMA topology 

B. Resource control 

C. resource metering 

D. virtual Machine Chimney 
E. The VLAN ID 

F. Processor Compatibility 
G. The startup order 

H. Automatic Start Action 

|. Integration Services 

J. Port mirroring 

K. Single-root I/O virtualization 


Answer: | 


Explanation: 
The Integration Services settings on virtual machines include services such as operating system 
shutdown, time synchronization, data exchange, Heartbeat, and Backup (volume snapshot services). 
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This snapshot will ensure that the state of VM1 is saved prior to backup. 


References: http://msdn.microsoft.com/en-us/library/dd405549(v=vs.85).aspx 
Exam Ref 70-410, Installing and Configuring Windows Server 2012 R2, Chapter 3: Configure Hyper-V, 


Objective 3.1: Create and Configure virtual machine settings, p.144 


Question: 17 


Your network contains a server named Server1 that runs Windows Server 2012 R2. Server1 has the 
Hyper-V server role installed. 

Server1 hosts four virtual machines named VM1, VM2, VM3, and VM4. 

Server1 is configured as shown in the following table. 


Hardware 
component 


Configuration 


Eight quad-core CPUs that have 
non-uniform memory access 
(NUMA) 


32 GB of RAM 
Two local 4-TB disks 


Processor 


Network Eight network adapters 
VMQ-supported 


PCI-SIG-supported 


VM2 sends and receives large amounts of data over the network. 

You need to ensure that the network traffic of VM2 bypasses the virtual switches of the parent 
partition. 

What should you configure? 


A. NUMA topology 

B. Resource control 

C. resource metering 

D. virtual Machine Chimney 
E. The VLAN ID 

F. Processor Compatibility 
G. The startup order 

H. Automatic Start Action 

|. Integration Services 

J. Port mirroring 

K. Single-root I/O virtualization 


Answer: K 


Explanation: 

Single-root I/O virtualization -capable network adapters can be assigned directly to a virtual machine 
to maximize network throughput while minimizing network latency and the CPU overhead required 
for processing network traffic. 


References: http://technet.microsoft.com/en-us/library/cc766320(v=ws.10).aspx 


http://technet.microsoft.com/en-us/library/hh831410.aspx 
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Exam Ref 70-410, Installing and Configuring Windows Server 2012 R2, Chapter 3: Configure Hyper-V, 
Objective 3.1: Create and Configure virtual machine settings, p.144 

Training Guide: Installing and Configuring Windows Server 2012 R2: Chapter 7: Hyper-V 
Virtualization, Lesson 2: Deploying and configuring virtual machines, p.335 


Question: 18 


Your network contains a server named Server1 that runs Windows Server 2012 R2. Server1 has the 
Hyper-V server role installed. 

Server! hosts four virtual machines named VM1, VM2, VM3, and VM4. 

Server1 is configured as shown in the following table. 


Hardware 
component 


Configuration 


Eight quad-core CPUs that have 
non-uniform memory access 
(NUMA) 


32 GB of RAM 


Processor 


Eight network adapters 
VMQ-supported 
PCI-SIG-supported 


You need to ensure that VM1 can use more CPU time than the other virtual machines when the CPUs 
on Server1 are under a heavy load. 
What should you configure? 


A. NUMA topology 

B. Resource control 

C. resource metering 

D. virtual Machine Chimney 
E. The VLAN ID 

F. Processor Compatibility 
G. The startup order 

H. Automatic Start Action 

|. Integration Services 

J. Port mirroring 

K. Single-root I/O virtualization 


Answer: B 


Explanation: 

B. Resource controls provide you with several ways to control the way that Hyper-V allocates 
resources to virtual machine. Resource control in used in the event where you need to adjust the 
computing resources of a virtual machine, you can reconfigure the resources to meet the changing 
needs. You can also specify resource controls to automate how resources are allocated to virtual 
machines. 

References: 
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http://technet.microsoft.com/en-us/library/cc766320(v=ws.10).aspx 
http://technet.microsoft.com/en-us/library/hh831410.aspx 
http://technet.microsoft.com/en-us/library/cc742470.aspx 

Exam Ref 70-410, Installing and Configuring Windows Server 2012 R2, Chapter 3: Configure Hyper-V, 
Objective 3.1: Create and Configure virtual machine settings, p.144 

Training Guide: Installing and Configuring Windows Server 2012 R2: Chapter 7: Hyper-V 
Virtualization, Lesson 2: Deploying and configuring virtual machines, p.335 


Question: 19 


HOTSPOT 

Your network contains an Active Directory domain named contoso.com. 

Computer accounts for the marketing department are in an organizational unit (OU) named 
Departments\Marketing\Computers. User accounts for the marketing department are in an OU 
named Departments\Marketing\Users. 

Marketing users can only log on to the client computers in the Departments\Marketing\Computers 
OU. 

You need to apply an application control policy to all of the marketing users. 

Which Group Policy Object (GPO) should you configure? 

To answer, select the appropriate GPO in the answer area. 
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ak File Action View Window Help 
e >| [i] aB 


_i& Group Policy Management 
4 À Forest: contoso.com 


4 3 Domains 
4 #3 contoso.com 
a, Default Domain Policy 


b Bl Sales 
4 2) Domain Controllers 
a Default Domain Controllers Policy 
p I} Group Policy Objects 
b > WMI Filters 
b JB Starter GPOs 
p TË Sites 
a? Group Policy Modeling 
TÈ, Group Policy Results 


Answer: 
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fh File Action View Window Help 
@ [maB mm 


2 E Policy Management Group Policy Management 
4 Forest: contoso.com Contents 
4 Domains 
4 J contoso.com Name 
a, Default Domain Policy AÀ Forest: contoso.com 


4 a Marketing _ 
(ai GPO2 | 


4 3) Domain Controllers 
a4 Default Domain Controllers Policy 
b LẸ Group Policy Objects 
p > WMI Filters 
p 2 Starter GPOs 
> Tẹ Sites 
4? Group Policy Modeling 
T}, Group Policy Results 


Application control policies specify which programs are allowed to run on the local computer and 
which are not. 

References: 

http://technet.microsoft.com/en-us/library/hh125923(v=ws.10).aspx 
http://technet.microsoft.com/en-us/library/cc781458(v=WS.10).aspx 
http://technet.microsoft.com/en-us/library/hh967461.aspx 
http://technet.microsoft.com/en-us/library/ee461050.aspx 
http://technet.microsoft.com/en-us/library/ee461044.aspx 


Question: 20 


HOTSPOT 

Your network contains an Active Directory domain named contoso.com. 

The domain contains an organizational unit (OU) named OU1 as shown in the OU1 exhibit. (Click the 
Exhibit button.) 
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File Action View Help 


#9 sim dO XOes Ee Saura 
T] Active Directory Users and Computers | Name 
b ~) Saved Queries 
4 i contoso.com 

p i Builtin 

b Computers 

p 2) Domain Controllers 

> > FereignSecurityPrincipals 

L] Managed Service Accounts 


2) out) 


Type Description 
Hè, Group! Security Group - Global 

R, User2 User 

% User4 User 


The membership of Group1 is shown in the Group1 exhibit. (Click the Exhibit button.) 


[General | Members | Member Of | Managed By]  —— = 


Members: 


Name Active Directory Domain Services Folder 
8, User1 centoso.com 
KA User2 contoss,com/OU1 


You configure GPO1 to prohibit access to Control Panel. GPO1 is linked to OU1 as shown in the GPO1 
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exhibit. (Click the Exhibit button.) 


im File Action View Window Help 
=| alr) a 
-3 Group Policy Management 
4 À Forest: contoso.com 
4 (3 Domains 
4 $5 contoso.com 
a, Default Domain Policy 
b 3! Demain Controllers 
4 3) 0U) 
aif GPO1 
b 5 Profiles 
b [> Group Policy Objects 
p D WMI Filters 
> ji Starter GPOs 
p [gp Sites 
a2 Group Policy Modeling 
©, Group Policy Results 


Page 27 


[cPo1 


Scope | Details | Settings | Delegation | 


Links 


Display links in this location 


[contoso -com 


The following sites, domains, and Ols are linked to this GPO: 


Location Bi Enforced 
| govi No 


[<] 


Security Altering 
The settings ìn this GPO can only apply to the following groups, users, and computers: 


Name E 
Kè, Group 1 (CONTOSO\Group 1) 
3, User3 (user3@contoso.com) 


Select Yes if the statement can be 


shown to be true based on the available information; otherwise 


select No. Each correct selection is worth one point. 


Userl can access Control Panel, 


User2 can access Control Panel, 


User3 can access Control Panel, 


User¢ can access Control Panel. 


https: 


Yes No 
$- e 
C C 
e e 
i C 


Answer: 
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Userl can access Control Panel 


User3 can access Control Panel 


5s Control Panel 


Explanation: 

Group Policy does NOT APPLY TO SECURITY GROUPS, only users and computers in an OU. 
Consequently, the only users in the OU are User2 and User4. Since the Security Filtering specifies 
that the policy will only apply to users/computers in the OU who are members of Group1 or User3, 
User4 will not have the policy applied. Since User2 is, in fact, a member of Group1, the policy will be 
applied to user 2. Thus, the only user who will not be able to access the control panel is User2. 


Question: 21 


HOTSPOT 

Your network contains an Active Directory domain named adatum.com. All domain controllers run 
Windows Server 2012 R2. All client computers run Windows 7. The computer accounts for all of the 
client computers are located in an organizational unit (OU) named OU1. 

An administrator links a Group Policy object (GPO) to OU1. The GPO contains several application 
control policies. 

You discover that the application control policies are not enforced on the client computers. 

You need to modify the GPO to ensure that the application control policies are enforced on the client 
computers. 

What should you configure in the GPO? 

To answer, select the appropriate service in the answer area. 
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File Action View Help 


Service Name “rie E | Startup Permission 


P Active Directory Domain Services Not Defined Not Defined | 
KF Active Directory Web Servi ces Not Define ed Not Defined 


BAe plication Experience Not Defined Not Defined | 


pplication identi Not Defined Not Defined 
r pplication Information Not Defined jefined | 
Ọ# Application Layer Gateway Service Not Defined Not Defined | 
(Application Management  NotDefined Not Defined | 
(HASP.NET State Service Not Defined Not Defined | 
W? Background Intelligent Transfer Service Not Defined Not Define ined | 
GF Base Filtering Engine Not Defined Not Defined 


G Broker Infrastructure Žž R Infrastructure Not Defined Not Defined | 


YF Certificate Propagation ~ Not Defined “Not Defined | 
(CNG Key isolation Not Defined Net Defined 
if fF COM+ Event System Not Defined Not Defir ned | 
COM System Appli ication NotDeined Not Defined | 
KF Computer Browser ~~ Not Defined Not Defined 
Út Credential Manager — NotDefined Not Defined | 
i ‘(Cryptographic Services — Not Defined Not Defined | 
ik Data Deduplication Service Not Not Defined Not Define d | Jv 


Explanation: 

Does AppLocker use any services for its rule enforcement? 

Yes, AppLocker uses the Application Identity service (AppIDSvc) for rule enforcement. For AppLocker 
rules to be enforced, this service must be set to start automatically in the GPO. 

Before you can enforce AppLocker policies, you must start the Application Identity service by using 
the Services snap-in console. 

Membership in the local Administrators group, or equivalent, is the minimum required to complete 
this procedure. 

To start the Application Identity service 

Click Start, click Administrative Tools, and then click Services. 

In the Services snap-in console, double-click Application Identity. 

In the Application Identity Properties dialog box, click Automatic in the Startup type list, click Start, 
and then click OK. 


Reference: http://technet.microsoft.com/en-us/library/dd759130.aspx 


Question: 22 


Your network contains an Active Directory domain named contoso.com. You have a Group Policy 
object (GPO) named GP1 that is linked to the domain. GP1 contains a software restriction policy that 
blocks an application named Appt. 

You have a workgroup computer named Computer! that runs Windows 8. A local Group Policy on 
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Computer1 contains an application control policy that allows App1. 
You join Computer1 to the domain. 

You need to prevent App1 from running on Computer1. 

What should you do? 


A. From Computer1, run gpupdate/force. 

B. From Group Policy Management, add an application control policy to GP1. 

C. From Group Policy Management, enable the Enforced option on GP1. 

D. In the local Group Policy of Computer1, configure a software restriction policy. 


Answer: B 


Explanation: 

AppLocker policies take precedence over policies generated by SRP on computers that are running an 
operating system that supports AppLocker. 

AppLocker policies in the GPO are applied, and they supersede the policies generated by SRP in the 
GPO and local AppLocker policies or policies generated by SRP. 


Question: 23 


Your network contains an Active Directory domain named contoso.com. All client computer accounts 
are in an organizational unit (OU) named AllComputers. Client computers run either Windows 7 or 
Windows 8. 

You create a Group Policy object (GPO) named GP1. 

You link GP1 to the AllComputers OU. 

You need to ensure that GP1 applies only to computers that have more than 8 GB of memory. 

What should you configure? 


A. The Security settings of GP1 

B. The Block Inheritance option for AllComputers 
C. The Security settings of AllComputers 

D. The WMI filter for GP1 


Answer: D 


Explanation: 

Windows Management Instrumentation (WMI) filters allow you to dynamically determine the scope 
of Group Policy objects (GPOs) based on attributes of the target computer. 

When a GPO that is linked to a WMI filter is applied on the target computer, the filter is evaluated on 
the target computer. If the WMI filter evaluates to false, the GPO is not applied (except if the client 
computer is running Windows Server, in which case the filter is ignored and the GPO is always 
applied). If the WMI filter evaluates to true, the GPO is applied. WMI filters, like GPOs, are stored on 
a per-domain basis. A WMI filter and the GPO it is linked to must be in the same domain. 

References: 

Training Guide: Installing and Configuring Windows Server 2012 R2: Chapter 10: Implementing Group 
Policy, p.470, 482 

http://technet.microsoft.com/en-us/library/jj134176 
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WMI filtering using GPMC 


Question: 24 


Your network contains an Active Directory domain named contoso.com. The domain contains an 
Application server named Server1. Server1 runs Windows Server 2012 R2. 

Server1 is configured as an FTP server. 

Client computers use an FTP Application named App1.exe. App1.exe uses TCP port 21 as the control 
port and dynamically requests a data port. 

On Server1, you create a firewall rule to allow connections on TCP port 21. 

You need to configure Server1 to support the client connections from App1.exe. 

What should you do? 


A. Run netsh advfirewall set global statefulftp enable. 

B. Create an inbound firewall rule to allow App1.exe. 

C. Create a tunnel connection security rule. 

D. Run Set-NetFirewallRule -DisplayName DynamicFTP -Profile Domain 


Answer: A 


Explanation: 

The netsh firewall context is supplied only for backward compatibility. We recommend that you do 
not use this context on a computer that is running Windows Vista or a later version of Windows. 

In the netsh advfirewall firewall context, the add command only has one variation, the add rule 
command. Netsh advfirewall set global statefulftp: 

Configures how Windows Firewall with Advanced Security handles FTP traffic that uses an initial 
connection on one port to request a data connection on a different port. 

When statefulftp is enabled, the firewall examines the PORT and PASV requests for these other port 
numbers and then allows the corresponding data connection to the port number that was requested. 


Syntax 

set global statefulftp { enable | disable | notconfigured } 
Parameters 

statefulftp can be set to one of the following values: 
enable 


The firewall tracks the port numbers specified in PORT command requests and in the responses to 
PASV requests, and then allows the incoming FTP data traffic entering on the requested port number. 
disable 

This is the default value. The firewall does not track outgoing PORT commands or PASV responses, 
and so incoming data connections on the PORT or PASV requested port is blocked as an unsolicited 
incoming connection. 

notconfigured 

Valid only when netsh is configuring a GPO by using the set store command. 


Question: 25 


Your network contains an Active Directory domain named contoso.com. You need to create the 
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Central Store for Group Policy Administrative Templates in adatum.com 
What should you copy? 


A. C:\Windows\System32\GroupPolicy to \\Adatum.com\Policies 

B. C:\Windows\PolicyDefinitions to \\Adatum.com\SYSVOL\Adatum.com\Policies 
C. C:\Windows\System32\GroupPolicy to \\Adatum.com\Netlogon 

D. C:\Windows\PolicyDefinitions to \\Adatum.com\Netlogon 


Answer: B 


Question: 26 


Your network contains an Active Directory domain named contoso.com. The domain computers that 
use IPV4 and IPv6. 

You have a DHCP server named Server1 that runs Windows Server 2012. 

You install Windows Server 2012 R2 on a server named Server2. You install the DHCP Server server 
role on Server2. 

You need to migrate the DHCP services from Server1 to Server2. The solution must meet the 
following requirements: 

Ensure that existing leases are migrated. 

Prevent lease conflicts. 

Which cmdlet should you use to retrieve the required information from server1? 


A. Run the Add-DhcpServer4Leave cmdlet and specify the -hostname parameter. 
B. Run the Get-DhcpServer4Lease cmdlet and specify the —AllLease parameter. 

C. Run the Send-SmigServerData cmdlet and specify the -computername cmdlet. 
D. Run the Export-DhcpServer cmdlet and specify the Leases parameter. 


Answer: D 


Question: 27 


You have a server named Server1 that runs Windows Server 2012 R2. Server1 has the Hyper-V server 
role installed. On Server1, you create a virtual machine named VM1. VM1 has a standard network 
adapter. 

You need to assign a specific amount of available network bandwidth to VM1. 

What should you do first? 


A. Remove the network adapter, and then add a new network adapter. 

B. Add a second network adapter, and then run the Set-VMNetworkAdapter cmdlet. 
C. Remove the network adapter, and then run the Set-VMNetworkAdapter cmdlet. 
D. Add a second network adapter, and then configure network adapter teaming. 


Answer: A 
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